kimi-plugin-cc 2.5.1 → 2.5.3

package/plugins/kimi-dsh/dist/commands/setup.js

@@ -9,7 +9,8 @@ import { SETUP_SUPPORTED_FLAGS } from "../parsing.js";
 // absolute Node path avoids PATH dependence under sanitized launches. Setup
 // probes the hook directly with resolveNodeBinary and through `/bin/sh -c`
 // using the exact installed command bytes. It also warns about broad permission
-// denies and refuses duplicate, orphaned, or malformed managed blocks.
+// denies, repairs orphan marker comments, and refuses remaining
+// duplicate, orphaned, or malformed managed blocks.
 //
 // Subcommands: install (default), --check, --uninstall [--all], and
 // --enable-review-gate/--disable-review-gate.
@@ -25,12 +26,13 @@ import { readPluginConfig, writePluginConfig } from "../config.js";
 import { RuntimeError } from "../errors.js";
 import { normalizeTopLevelInlineHooks, validateKimiHookSetForEnvironment, withKimiConfigLock, } from "../hooks/config-safety.js";
 import { buildHookShellCommand, hostIdFromHookCommand, resolveHookScriptPath, resolveHostId, resolveNodeBinary, } from "../hooks/install-paths.js";
-import { decodeManagedCommandLine, effectiveHost, evaluateInstalled, findUnmanagedApprovalHookBlocks, MARKERS, parseManagedBlock, } from "../hooks/managed-block.js";
+import { decodeManagedCommandLine, effectiveHost, evaluateInstalled, findUnmanagedApprovalHookBlocks, markerCommentLines, MARKERS, parseManagedBlock, } from "../hooks/managed-block.js";
 import { formatVersionOutOfRangeWarning, probeKimiVersion, } from "../kimi-version-probe.js";
 import { isNativeV2CertifiedVersion } from "../kimi-engine.js";
 import { resolveKimiHome } from "../kimi-home.js";
 import { ensurePluginPaths, resolvePluginPaths } from "../paths.js";
 import { KIMI_PLUGIN_CC_VERSION } from "../version.js";
+import { parse as parseToml } from "../vendor/smol-toml/parse.js";
 const BEGIN_MARKER_PREFIX = "# === BEGIN kimi-plugin-cc-managed";
 const DEFAULT_HOOK_TIMEOUT_S = 15;
 // Probe timing. The direct script probe is local and fast; allow 5s for
@@ -119,7 +121,17 @@ async function runInstall(configPath, hookScriptPath, hostId, reviewGateEnabled,
     const mutation = await withKimiConfigLock(configPath, async () => {
         const original = await readConfigSafe(configPath);
         const lineEnding = detectLineEnding(original);
-        const inlineHooks = normalizeTopLevelInlineHooks(original, lineEnding);
+        try {
+            parseToml(original);
+        }
+        catch {
+            await assertKimiHookSetValid(original, configPath, "setup.install", context.env);
+        }
+        const repaired = removeOrphanMarkers(original);
+        if (repaired.count > 0) {
+            warnings.push(`Removed ${repaired.count} orphaned managed marker comment(s); surrounding config was preserved.`);
+        }
+        const inlineHooks = normalizeTopLevelInlineHooks(repaired.contents, lineEnding);
         if (inlineHooks.found) {
             // Validate before normalizing so an invalid inline entry is reported
             // against the user's original bytes and the config remains untouched.
@@ -133,7 +145,7 @@ async function runInstall(configPath, hookScriptPath, hostId, reviewGateEnabled,
         // splice line numbers. Another host's marker-less table may be its live hook
         // after a config rewrite strips comments, so it must remain untouched.
         const expectedCommand = buildHookShellCommand(hookScriptPath, context.env);
-        const { pruned, count: prunedCount, commands: prunedCommands } = pruneOrphanApprovalHooks(inlineHooks.contents, lineEnding, hostId, expectedCommand);
+        const { pruned, count: prunedCount, commands: prunedCommands } = pruneOrphanApprovalHooks(inlineHooks.contents, hostId, expectedCommand);
         const existing = pruned;
         if (prunedCount > 0) {
             const readorned = prunedCommands.includes(expectedCommand);
@@ -145,7 +157,7 @@ async function runInstall(configPath, hookScriptPath, hostId, reviewGateEnabled,
         if (state.kind === "orphan") {
             throw new RuntimeError("SETUP_ORPHAN_MARKERS", [
                 `kimi-code config at ${configPath} contains an orphaned ${state.detail} marker.`,
-                "Run `/kimi:setup --uninstall` to clean up, then re-run `/kimi:setup`.",
+                "Inspect the managed marker comments and re-run setup.",
             ].join(" "), "setup.install", { details: { configPath, orphan: state.detail } });
         }
         if (state.kind === "duplicate") {
@@ -393,12 +405,11 @@ async function runUninstallLocked(configPath, hookScriptPath, hostId, removeAllH
     // other hosts' blocks and live marker-less tables remain intact. `--all` is
     // the explicit every-host sweep for all of this plugin's hook tables.
     const { stripped: strippedMarkers, removedBlocks, orphansLeft } = stripManagedBlocks(existing, hostId, removeAllHosts);
-    const lineEnding = detectLineEnding(existing);
     // Exact current command bytes also identify this host's table when a host-id
     // override disagrees with path derivation or a dev path is outside the strict
     // ownership pattern.
     const expectedCommand = buildHookShellCommand(hookScriptPath, context.env);
-    const { pruned: stripped, count: prunedCount } = pruneOrphanApprovalHooks(strippedMarkers, lineEnding, removeAllHosts ? undefined : hostId, expectedCommand);
+    const { pruned: stripped, count: prunedCount } = pruneOrphanApprovalHooks(strippedMarkers, removeAllHosts ? undefined : hostId, expectedCommand);
     const changed = stripped !== existing;
     if (changed) {
         await writeConfigAtomic(configPath, stripped);
@@ -517,10 +528,10 @@ function detectLineEnding(contents) {
     return contents.includes("\r\n") ? "\r\n" : "\n";
 }
 function spliceBlock(contents, beginLine, endLine, replacement, lineEnding) {
-    const lines = splitPreservingEnding(contents);
-    const before = lines.slice(0, beginLine).join(lineEnding);
-    const after = lines.slice(endLine + 1).join(lineEnding);
-    const beforeWithSep = before.endsWith(lineEnding) || before.length === 0 ? before : `${before}${lineEnding}`;
+    const lines = contents.split(/(?<=\n)/);
+    const before = lines.slice(0, beginLine).join("");
+    const after = lines.slice(endLine + 1).join("");
+    const beforeWithSep = before.endsWith("\n") || before.length === 0 ? before : `${before}${lineEnding}`;
     const replacementWithEnding = replacement.endsWith(lineEnding) ? replacement : `${replacement}${lineEnding}`;
     return `${beforeWithSep}${replacementWithEnding}${after}`;
 }
@@ -536,14 +547,54 @@ function splitPreservingEnding(contents) {
     // pass the desired line ending).
     return contents.split("\n").map((line) => line.replace(/\r$/, ""));
 }
+// A partial upstream hooks-array rewrite can leave one marker comment behind.
+// Remove only unpaired marker comments, never the intervening content. The
+// normal full-file validation still gates writes.
+function removeOrphanMarkers(contents) {
+    const lines = splitPreservingEnding(contents);
+    const orphans = [];
+    const comments = markerCommentLines(contents);
+    let open = null;
+    for (let i = 0; i < lines.length; i += 1) {
+        if (!comments.has(i))
+            continue;
+        const line = lines[i].trim();
+        const begin = MARKERS.BEGIN_LINE_RE.exec(line);
+        if (begin !== null) {
+            if (open !== null)
+                orphans.push(open);
+            open = { index: i, host: begin[1]?.toLowerCase() ?? null };
+        }
+        else {
+            const end = MARKERS.END_LINE_RE.exec(line);
+            if (end === null)
+                continue;
+            const endMarker = { index: i, host: end[1]?.toLowerCase() ?? null };
+            if (open === null)
+                orphans.push(endMarker);
+            else {
+                if (open.host !== endMarker.host)
+                    orphans.push(open, endMarker);
+                open = null;
+            }
+        }
+    }
+    if (open !== null)
+        orphans.push(open);
+    const remove = new Set(orphans.map((marker) => marker.index));
+    return remove.size === 0
+        ? { contents, count: 0 }
+        : { contents: contents.split(/(?<=\n)/).filter((_, index) => !remove.has(index)).join(""), count: remove.size };
+}
 /**
  * Remove managed blocks owned by `currentHost`, or every host with `removeAll`.
  * Ownership comes from the marker suffix or a legacy command's derived host.
  * Orphan markers are removed individually so surrounding user content survives.
  */
 function stripManagedBlocks(contents, currentHost, removeAll) {
-    const lineEnding = detectLineEnding(contents);
     const lines = splitPreservingEnding(contents);
+    const rawLines = contents.split(/(?<=\n)/);
+    const markerLines = markerCommentLines(contents);
     const result = [];
     const orphansLeft = [];
     let removedBlocks = 0;
@@ -567,7 +618,7 @@ function stripManagedBlocks(contents, currentHost, removeAll) {
     while (i < lines.length) {
         const line = lines[i];
         const trimmed = line.trim();
-        const begin = MARKERS.BEGIN_LINE_RE.exec(trimmed);
+        const begin = markerLines.has(i) ? MARKERS.BEGIN_LINE_RE.exec(trimmed) : null;
         if (begin !== null) {
             const beginHost = begin[1]?.toLowerCase() ?? null;
             // Look ahead for the matching END, capturing the block's command en route.
@@ -575,12 +626,14 @@ function stripManagedBlocks(contents, currentHost, removeAll) {
             let blockCommand = null;
             for (let j = i + 1; j < lines.length; j += 1) {
                 const nextTrimmed = lines[j].trim();
-                if (MARKERS.BEGIN_LINE_RE.test(nextTrimmed)) {
+                if (markerLines.has(j) && MARKERS.BEGIN_LINE_RE.test(nextTrimmed)) {
                     // Two BEGINs in a row — the outer one is an orphan.
                     break;
                 }
-                if (MARKERS.END_LINE_RE.test(nextTrimmed)) {
-                    endIdx = j;
+                const end = markerLines.has(j) ? MARKERS.END_LINE_RE.exec(nextTrimmed) : null;
+                if (end !== null) {
+                    if ((end[1]?.toLowerCase() ?? null) === beginHost)
+                        endIdx = j;
                     break;
                 }
                 const decoded = decodeManagedCommandLine(nextTrimmed);
@@ -594,7 +647,7 @@ function stripManagedBlocks(contents, currentHost, removeAll) {
                     i += 1;
                     continue;
                 }
-                result.push(line);
+                result.push(rawLines[i]);
                 i += 1;
                 continue;
             }
@@ -606,11 +659,11 @@ function stripManagedBlocks(contents, currentHost, removeAll) {
             }
             // Another host's block — keep it verbatim.
             for (let k = i; k <= endIdx; k += 1)
-                result.push(lines[k]);
+                result.push(rawLines[k]);
             i = endIdx + 1;
             continue;
         }
-        const end = MARKERS.END_LINE_RE.exec(trimmed);
+        const end = markerLines.has(i) ? MARKERS.END_LINE_RE.exec(trimmed) : null;
         if (end !== null) {
             const endHost = end[1]?.toLowerCase() ?? null;
             // Orphan END with no preceding BEGIN: drop only this line (if ours).
@@ -619,27 +672,14 @@ function stripManagedBlocks(contents, currentHost, removeAll) {
                 i += 1;
                 continue;
             }
-            result.push(line);
+            result.push(rawLines[i]);
             i += 1;
             continue;
         }
-        result.push(line);
+        result.push(rawLines[i]);
         i += 1;
     }
-    const collapsed = [];
-    let blankRun = 0;
-    for (const line of result) {
-        if (line.length === 0) {
-            blankRun += 1;
-            if (blankRun <= 2)
-                collapsed.push(line);
-        }
-        else {
-            blankRun = 0;
-            collapsed.push(line);
-        }
-    }
-    return { stripped: collapsed.join(lineEnding), removedBlocks, orphansLeft };
+    return { stripped: result.join(""), removedBlocks, orphansLeft };
 }
 /**
  * Remove orphaned, marker-less `[[hooks]]` tables that are unambiguously this
@@ -654,7 +694,7 @@ function stripManagedBlocks(contents, currentHost, removeAll) {
  * host — REQUIRED for scoped install/uninstall so one host never disarms the
  * other's live (marker-stripped) hook. Omit only for `--uninstall --all`.
  */
-function pruneOrphanApprovalHooks(contents, lineEnding, ownedBy, alsoMatchCommand) {
+function pruneOrphanApprovalHooks(contents, ownedBy, alsoMatchCommand) {
     const ranges = findUnmanagedApprovalHookBlocks(contents, ownedBy, alsoMatchCommand);
     if (ranges.length === 0)
         return { pruned: contents, count: 0, commands: [] };
@@ -663,23 +703,10 @@ function pruneOrphanApprovalHooks(contents, lineEnding, ownedBy, alsoMatchComman
         for (let i = start; i < end; i += 1)
             remove.add(i);
     }
-    const lines = splitPreservingEnding(contents);
+    const lines = contents.split(/(?<=\n)/);
     const kept = lines.filter((_, idx) => !remove.has(idx));
-    const collapsed = [];
-    let blankRun = 0;
-    for (const line of kept) {
-        if (line.length === 0) {
-            blankRun += 1;
-            if (blankRun <= 2)
-                collapsed.push(line);
-        }
-        else {
-            blankRun = 0;
-            collapsed.push(line);
-        }
-    }
     return {
-        pruned: collapsed.join(lineEnding),
+        pruned: kept.join(""),
         count: ranges.length,
         commands: ranges.map((range) => range.command),
     };

package/plugins/kimi-dsh/dist/commands/swarm.js

@@ -28,8 +28,8 @@ import { buildKimiSessionTitle, syncKimiSessionTitle } from "../session-title.js
 // only the wall-clock hard bound. Read/write modes reuse review/rescue lineage,
 // and the mandatory PreToolUse hook enforces read-only policy or trusted-worktree
 // write confinement on the coordinator and every subagent. Write mode requires
-// kimi-code 0.18.0+. Exact 2.3.2, 2.3.3, 2.4.0 and 2.4.1 additionally activate a same-job
-// session through a bounded loopback web lifecycle, then resume it through the normal print path.
+// kimi-code 0.18.0+. Exact 2.3.2, 2.3.3, 2.4.0, 2.4.1, 2.5.0 and 2.5.1 additionally
+// activate a same-job session through a bounded loopback web lifecycle, then resume it through the normal print path.
 const SWARM_SUMMARY_MAX = 120;
 const SWARM_AGENT_PROFILE = "<swarm>";
 const SWARM_WRITE_AGENT_PROFILE = "<swarm-write>";

package/plugins/kimi-dsh/dist/dsh/companion.js

@@ -1,6 +1,7 @@
 import { randomUUID } from "node:crypto";
 import { brandString } from "@deepseek-ai/dsh-brand";
 import { assertUsableCwd, settleRunResult, subprocessRunHandle, } from "@deepseek-ai/dsh-subagent";
+import { preferStableNodePath } from "../hooks/install-paths.js";
 export const DSH_COMPANION_OPERATIONS = [
     "ask",
     "review",
@@ -20,7 +21,7 @@ export function companionTextTask(prompt) {
     }
     return text;
 }
-export function companionArgv(operation, prompt, companionPath, nodeBin = process.execPath, options = {}) {
+export function companionArgv(operation, prompt, companionPath, nodeBin = preferStableNodePath(process.execPath), options = {}) {
     const command = operation === "ask" || operation === "review"
         ? [operation]
         : operation === "swarm-write"
@@ -41,7 +42,7 @@ export function companionArgv(operation, prompt, companionPath, nodeBin = proces
         prompt,
     ];
 }
-export function companionEnvironment(dataRoot, cwd, env, nodeBin = process.execPath) {
+export function companionEnvironment(dataRoot, cwd, env, nodeBin = preferStableNodePath(process.execPath)) {
     return {
         ...env,
         KIMI_PLUGIN_CC_DATA: dataRoot,
@@ -79,8 +80,9 @@ export async function startCompanionRun(request, operation, spec) {
     request.signal.addEventListener("abort", onAbort, { once: true });
     let child;
     try {
+        const nodeBin = preferStableNodePath(process.execPath);
         child = spec.spawn({
-            argv: companionArgv(operation, prompt, spec.companionPath, process.execPath, spec),
+            argv: companionArgv(operation, prompt, spec.companionPath, nodeBin, spec),
             cwd,
             stdio: {
                 stdin: "ignore",
@@ -89,7 +91,7 @@ export async function startCompanionRun(request, operation, spec) {
             },
             graceMs: spec.disposeGraceMs,
             signal: termination.signal,
-            env: companionEnvironment(spec.dataRoot, cwd, spec.env),
+            env: companionEnvironment(spec.dataRoot, cwd, spec.env, nodeBin),
         });
     }
     catch (error) {
@@ -141,8 +143,9 @@ export async function startCompanionRun(request, operation, spec) {
     });
 }
 export async function runCompanionCommand(argv, cwd, spec, signal) {
+    const nodeBin = preferStableNodePath(process.execPath);
     const child = spec.spawn({
-        argv: [process.execPath, spec.companionPath, ...argv],
+        argv: [nodeBin, spec.companionPath, ...argv],
         cwd,
         stdio: {
             stdin: "ignore",
@@ -151,7 +154,7 @@ export async function runCompanionCommand(argv, cwd, spec, signal) {
         },
         graceMs: spec.disposeGraceMs,
         signal,
-        env: companionEnvironment(spec.dataRoot, cwd, spec.env),
+        env: companionEnvironment(spec.dataRoot, cwd, spec.env, nodeBin),
     });
     try {
         const outcome = await child.done;

package/plugins/kimi-dsh/dist/dsh/index.js

@@ -8,6 +8,12 @@ import { DSH_COMPANION_OPERATIONS, runCompanionCommand, startCompanionRun, } fro
 import { parseDurationMs } from "../parsing.js";
 export const name = "kimi-plugin-cc";
 export const inject = ["subagents", "subprocess"];
+export const DSH_TOOL_GUIDANCE = [
+    "Kimi delegation tools have different write boundaries:",
+    "kimi_ask, kimi_review, and kimi_challenge are read-only; kimi_swarm is a read-only parallel review.",
+    "kimi_rescue and kimi_pursue can edit the selected workspace; kimi_pursue continues toward a bounded goal.",
+    "kimi_swarm_write edits a temporary worktree and returns a patch without applying it.",
+].join(" ");
 const DEFAULT_DISPOSE_GRACE_MS = 6_000;
 const DEFAULT_MAX_OUTPUT_BYTES = 16 * 1024 * 1024;
 const MAX_TIMER_DELAY_MS = 2_147_483_647;
@@ -50,8 +56,8 @@ function resolveConfig(config) {
     if (!path.isAbsolute(resolved.dataRoot)) {
         throw new Error("kimi-plugin-cc: dataRoot must be absolute");
     }
-    if (!Number.isFinite(resolved.disposeGraceMs) || resolved.disposeGraceMs <= 0 || resolved.disposeGraceMs > MAX_TIMER_DELAY_MS) {
-        throw new Error(`kimi-plugin-cc: disposeGraceMs must be positive, finite, and no greater than ${MAX_TIMER_DELAY_MS}`);
+    if (!Number.isFinite(resolved.disposeGraceMs) || resolved.disposeGraceMs < DEFAULT_DISPOSE_GRACE_MS || resolved.disposeGraceMs > MAX_TIMER_DELAY_MS) {
+        throw new Error(`kimi-plugin-cc: disposeGraceMs must be at least ${DEFAULT_DISPOSE_GRACE_MS} and no greater than ${MAX_TIMER_DELAY_MS}`);
     }
     if (!Number.isSafeInteger(resolved.maxOutputBytes) || resolved.maxOutputBytes <= 0) {
         throw new Error("kimi-plugin-cc: maxOutputBytes must be a positive safe integer");
@@ -105,6 +111,13 @@ export function apply(ctx, config) {
     for (const operation of DSH_COMPANION_OPERATIONS) {
         ctx.subagents.registerProvider(new KimiCompanionProvider(`kimi-${operation}`, operation, spec));
     }
+    ctx.inject(["systemPrompt"], (promptCtx) => {
+        promptCtx.systemPrompt.section({
+            name: "kimi-plugin-cc:tool-boundaries",
+            order: promptCtx.systemPrompt.getSectionOrder("TOOL_SUBAGENT"),
+            text: () => DSH_TOOL_GUIDANCE,
+        });
+    });
     ctx.inject(["commands"], (commandCtx) => {
         const execute = async (invocation, argv) => {
             const directories = commandCtx.get("workingDirectory");

package/plugins/kimi-dsh/dist/hooks/config-safety.js

@@ -595,7 +595,8 @@ function validateVersionSensitiveEvents(events, version) {
     // Exact schemas reviewed at 2.0.0 (1b89e4b0), 2.0.1 (caf7d4e2),
     // 2.0.2 (9d07f634), 2.1.0 (52437299), 2.1.1 (f67e6398), 2.2.0 (472192c3),
     // 2.3.0 (b5e28fd6), 2.3.1 (684bae9e), 2.3.2 (b8dd3a13), 2.3.3 (ec495f0c),
-    // 2.4.0 (f26e4d91), and 2.4.1 (2c73f3f5): the additive events and HookDefSchema are unchanged.
+    // 2.4.0 (f26e4d91), 2.4.1 (2c73f3f5), 2.5.0 (41c34143), and 2.5.1 (1b02030d):
+    // the additive events and HookDefSchema are unchanged.
     // Require the full version string AND matching components; no inferred 2.x compatibility.
     if (version.major === 2 && ((version.minor === 0 && ((version.version === "2.0.0" && version.patch === 0) ||
         (version.version === "2.0.1" && version.patch === 1) ||
@@ -608,7 +609,9 @@ function validateVersionSensitiveEvents(events, version) {
             (version.version === "2.3.2" && version.patch === 2) ||
             (version.version === "2.3.3" && version.patch === 3))) ||
         (version.minor === 4 && ((version.version === "2.4.0" && version.patch === 0) ||
-            (version.version === "2.4.1" && version.patch === 1))))) {
+            (version.version === "2.4.1" && version.patch === 1))) ||
+        (version.minor === 5 && ((version.version === "2.5.0" && version.patch === 0) ||
+            (version.version === "2.5.1" && version.patch === 1))))) {
         return { valid: true };
     }
     if (version.major !== 0) {

package/plugins/kimi-dsh/dist/hooks/managed-block.js

@@ -45,10 +45,80 @@ const MATCHER_LINE_RE = /^matcher\s*=/;
 /** `timeout = <int>` — the only other key our managed [[hooks]] table emits. */
 const TIMEOUT_LINE_RE = /^timeout\s*=\s*\d+\s*$/;
 const HOOKS_TABLE_RE = /^\[\[hooks\]\]\s*$/;
+// Recognize comment lines lexically, not text inside TOML string values.
+// Whole-document parsing remains the authority for TOML validity.
+function scanTomlLines(contents) {
+    const markers = new Set();
+    const tables = new Set();
+    let state = "plain";
+    let line = 0;
+    let blankPrefix = true;
+    for (let i = 0; i < contents.length; i += 1) {
+        const c = contents[i];
+        if (c === "\n") {
+            line += 1;
+            blankPrefix = true;
+            continue;
+        }
+        const onlyWhitespaceBefore = blankPrefix;
+        if (c !== " " && c !== "\t" && c !== "\r")
+            blankPrefix = false;
+        if (state === "plain") {
+            if (c === "[" && onlyWhitespaceBefore)
+                tables.add(line);
+            if (c === "#") {
+                if (onlyWhitespaceBefore) {
+                    const end = contents.indexOf("\n", i);
+                    const comment = contents.slice(i, end < 0 ? contents.length : end).trim();
+                    if (BEGIN_LINE_RE.test(comment) || END_LINE_RE.test(comment))
+                        markers.add(line);
+                }
+                const end = contents.indexOf("\n", i);
+                if (end < 0)
+                    break;
+                i = end - 1;
+            }
+            else if (c === '"' || c === "'") {
+                const triple = contents.slice(i, i + 3) === c.repeat(3);
+                state = c === '"' ? (triple ? "multibasic" : "basic") : (triple ? "multiliteral" : "literal");
+                if (triple)
+                    i += 2;
+            }
+        }
+        else {
+            const basic = state === "basic" || state === "multibasic";
+            const quote = basic ? '"' : "'";
+            if (basic && c === "\\") {
+                if (contents[i + 1] === "\n") {
+                    line += 1;
+                    blankPrefix = true;
+                }
+                i += 1;
+                continue;
+            }
+            if (c !== quote)
+                continue;
+            if (state === "basic" || state === "literal")
+                state = "plain";
+            else if (contents.slice(i, i + 3) === quote.repeat(3)) {
+                while (contents[i + 1] === quote)
+                    i += 1;
+                state = "plain";
+            }
+        }
+    }
+    return { markers, tables };
+}
+export function markerCommentLines(contents) {
+    return scanTomlLines(contents).markers;
+}
 /** Locate every BEGIN/END marker line, in order, with its parsed host id. */
 function findMarkers(lines) {
     const hits = [];
+    const comments = markerCommentLines(lines.join("\n"));
     for (let i = 0; i < lines.length; i += 1) {
+        if (!comments.has(i))
+            continue;
         const trimmed = lines[i].trim();
         const begin = BEGIN_LINE_RE.exec(trimmed);
         if (begin !== null) {
@@ -66,7 +136,7 @@ function findMarkers(lines) {
 }
 /**
  * Pair BEGIN/END markers into well-formed blocks. Return the first orphan
- * (BEGIN-without-END or END-without-BEGIN); either is a hard error for install.
+ * (BEGIN-without-END or END-without-BEGIN); verification fails closed on either.
  */
 function pairBlocks(lines) {
     const markers = findMarkers(lines);
@@ -83,6 +153,8 @@ function pairBlocks(lines) {
         // end
         if (open === null)
             return { orphan: "END-without-BEGIN" };
+        if (open.hostId !== marker.hostId)
+            return { orphan: "BEGIN-without-END" };
         const body = validateBlockBody(lines.slice(open.index + 1, marker.index));
         blocks.push({
             hostId: open.hostId,
@@ -436,13 +508,13 @@ export function evaluateInstalled(contents, expectedCommand, opts) {
  * The deletion range `[start, end)` is conservative: only the contiguous
  * non-blank body after `[[hooks]]`, stopping at a blank line, table header, or
  * managed marker so adjacent user content is preserved. A separate full-span
- * scan rejects matcher lines recognized by MATCHER_LINE_RE to avoid half-cutting
- * a table. That scan is deliberately heuristic and does not claim to recognize
- * every quoted or dotted TOML matcher spelling. `command` is decoded for the
- * caller's ownership checks.
+ * scan refuses any further TOML field before the next table, including quoted
+ * and dotted keys, so pruning cannot attach those fields to another table.
+ * `command` is decoded for the caller's ownership checks.
  */
 export function findBareApprovalHookTables(contents) {
     const lines = contents.split("\n").map((line) => line.replace(/\r$/, ""));
+    const tableLines = scanTomlLines(contents).tables;
     const managed = new Set();
     const paired = pairBlocks(lines);
     if ("blocks" in paired) {
@@ -455,7 +527,7 @@ export function findBareApprovalHookTables(contents) {
     for (let i = 0; i < lines.length; i += 1) {
         if (managed.has(i))
             continue;
-        if (!HOOKS_TABLE_RE.test(lines[i].trim()))
+        if (!tableLines.has(i) || !HOOKS_TABLE_RE.test(lines[i].trim()))
             continue;
         // Collect the contiguous table body.
         let j = i + 1;
@@ -500,22 +572,16 @@ export function findBareApprovalHookTables(contents) {
             }
             j += 1;
         }
-        // A blank line does NOT end a TOML table; membership continues to the next
-        // header or EOF. The deletion range nevertheless stops at the blank to
-        // preserve adjacent user content. Scan the remaining span for matcher lines
-        // this scanner recognizes and reject the table rather than half-cutting it:
-        // matcher is schema-valid but can disable the hook at runtime. Foreign keys
-        // and other TOML spellings are handled by whole-file schema validation and
-        // the parser-based installed checks, not by this prune heuristic.
-        let matcherBeyondBody = false;
+        // Blank lines and marker comments do not end a TOML table. Never leave any
+        // field behind to be rebound to a preceding table after pruning, regardless
+        // of the field's spelling or whether it is valid for a hook.
+        let fieldBeyondBody = false;
         for (let k = j; k < lines.length; k += 1) {
             const t = lines[k].trim();
-            // The current table's TOML span ends at the next table header or a
-            // managed marker; a matcher past that point belongs to a different table.
-            if (t.startsWith("[") || BEGIN_LINE_RE.test(t) || END_LINE_RE.test(t))
+            if (tableLines.has(k))
                 break;
-            if (MATCHER_LINE_RE.test(t)) {
-                matcherBeyondBody = true;
+            if (t.length > 0 && !t.startsWith("#")) {
+                fieldBeyondBody = true;
                 break;
             }
         }
@@ -527,7 +593,7 @@ export function findBareApprovalHookTables(contents) {
             commandDecoded.length > 0 &&
             hasPreToolUseEvent &&
             !hasMatcher &&
-            !matcherBeyondBody) {
+            !fieldBeyondBody) {
             ranges.push({ start: i, end: j, command: commandDecoded });
         }
     }

package/plugins/kimi-dsh/dist/kimi-command.js

@@ -47,6 +47,7 @@ const RESERVED_PREFIX_FLAGS = new Set([
     "--plan", "--auto", "-y", "--yolo", "--yes", "--auto-approve", "--manual",
     // Model / profile / roots.
     "-m", "--model", "--skills-dir", "--agent", "--agent-file", "--add-dir",
+    "--environment", "--environment-cwd",
     // Terminal informational flags (would replace the run with a banner).
     "-V", "--version", "-h", "--help",
 ]);

package/plugins/kimi-dsh/dist/kimi-engine.js

@@ -45,6 +45,8 @@ export const NATIVE_V2_CERTIFIED_VERSIONS = Object.freeze([
     "2.3.3",
     "2.4.0",
     "2.4.1",
+    "2.5.0",
+    "2.5.1",
 ]);
 /** Per-operation native-v2 certification. One green operation never certifies another. */
 export const NATIVE_V2_CERTIFIED = new Map([
@@ -127,6 +129,7 @@ export async function prepareKimiExecutionPlan(options) {
             kimiHome: resolveKimiHome(options.env, options.cwd),
             env: options.env,
             resumeSessionId: options.resumeSessionId,
+            expectedExecutionRoot: options.cwd,
             stage: "kimi-engine.plan",
         });
     };